---
name: "IP_PASSSEC"
section: "2const"
platform: "linux"
package: "man-pages"
version: "6.19-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/IP_PASSSEC"
---

# IP\_PASSSEC(2const)

receive the security context of the peer socket

## NAME

IP\_PASSSEC - receive the security context of the peer socket

## LIBRARY

Standard C library (*libc*, *-lc*)

## SYNOPSIS

```
#include <netinet/in.h>  /* Definition of IP* constants */
#include <sys/socket.h>
```

**int setsockopt(int** *sockfd***, IPPROTO\_IP, IP\_PASSSEC,**                **const int \****enable***, sizeof(int));** **int getsockopt(int** *sockfd***, IPPROTO\_IP, IP\_PASSSEC,**                **int \****enabled***, sizeof(int));**

## DESCRIPTION

If labeled IPSEC or NetLabel is configured on the sending and receiving hosts, this option enables receiving of the security context of the peer socket in an ancillary message of type **SCM\_SECURITY** retrieved using [**recvmsg**(2)](/recvmsg/2.md).

This option is supported only for UDP sockets; for TCP or SCTP sockets, see [**SO\_PEERSEC**(2const)](/SO_PEERSEC/2const.md).

The security context returned in the **SCM\_SECURITY** ancillary message is of the same format as the one described in [**SO\_PEERSEC**(2const)](/SO_PEERSEC/2const.md).

## ERRORS

See [**IPPROTO\_IP**(2const)](/IPPROTO_IP/2const.md). See [**setsockopt**(2)](/setsockopt/2.md). See [**ip**(7)](/ip/7.md).

## STANDARDS

Linux.

## HISTORY

Linux 2.6.17.

## CAVEATS

The reuse of the **SCM\_SECURITY** message type for the **IP\_PASSSEC** socket option was likely a mistake, since other IP control messages use their own numbering scheme in the IP namespace and often use the socket option value as the message type. There is no conflict currently since the IP option with the same value as **SCM\_SECURITY** is [**IP\_HDRINCL**(2const)](/IP_HDRINCL/2const.md) and this is never used for a control message type.

## SEE ALSO

[**IPPROTO\_IP**(2const)](/IPPROTO_IP/2const.md), [**setsockopt**(2)](/setsockopt/2.md), [**ip**(7)](/ip/7.md)